swadhinbiswas 🚀 ci: PyPI publishing via OIDC trusted publishing — fixed uv publish command, GH release in-pipeline, removed dead publish.yml · 8/7/2026
bf007b1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
name: CI & Wheel Release Pipeline
on:
push:
branches: [ main, master ]
tags: [ 'v*' ]
pull_request:
branches: [ main, master ]
workflow_dispatch:
permissions:
contents: read
jobs:
test-rust:
name: Cargo Test & Lint (Linux x86_64)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
components: clippy, rustfmt
- name: Install cargo-deny
uses: taiki-e/install-action@v2
with:
tool: cargo-deny
- name: Security Advisory & License Check
run: cargo deny check
- name: Run Tests
run: cargo test --workspace
- name: Run Clippy
run: cargo clippy --workspace --tests -- -D warnings
- name: Check Formatting
run: cargo fmt --check
miri-test:
name: Memory Safety (ASan + targeted Miri)
runs-on: ubuntu-latest
needs: test-rust
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@nightly
with:
components: miri, rust-src
- name: Run memory-safety gate
# Fast: ASan on the full core suite + targeted Miri on the only
# unsafe module (memory.rs). See scripts/sanitize.sh.
run: bash scripts/sanitize.sh
build-wheels:
name: Build Wheels (${{ matrix.os }} - ${{ matrix.target }})
runs-on: ${{ matrix.os }}
needs: miri-test
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
target: x86_64
args: --manylinux 2_28
- os: ubuntu-latest
target: aarch64
args: --manylinux 2_28
- os: ubuntu-latest
target: x86_64
args: --musllinux 1_2
- os: macos-latest
target: x86_64
- os: macos-latest
target: aarch64
- os: windows-latest
target: x64
# Free-threaded CPython (3.14t): parallel GIL-free execution. The
# limited API (abi3) cannot be free-threaded, so these builds use
# --no-default-features (abi3 is the only default feature that must
# go; mail/http3/orjson stay).
- os: ubuntu-latest
target: x86_64
python: "3.14t"
args: --manylinux 2_28 --no-default-features --features mail,http3,orjson
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v5
with:
python-version: ${{ matrix.python || '3.12' }}
enable-cache: true
cache-dependency-glob: crates/justapi-py/pyproject.toml
- name: Build wheels via Maturin
uses: PyO3/maturin-action@v1
with:
target: ${{ matrix.target }}
args: --release --out dist ${{ matrix.args }}
manifest-path: crates/justapi-py/Cargo.toml
interpreter: ${{ matrix.python || '' }}
- name: Install wheel & test
shell: bash
run: |
uv venv
uv pip install dist/*.whl pytest
uv run python -m pytest crates/justapi-py/tests/ -v --tb=short
- name: Upload Wheels
uses: actions/upload-artifact@v4
with:
name: wheels-${{ matrix.os }}-${{ matrix.target }}-${{ strategy.job-index }}
path: dist/*.whl
publish:
name: Publish to PyPI + GitHub Release
runs-on: ubuntu-latest
needs: build-wheels
if: startsWith(github.ref, 'refs/tags/v')
# OIDC trusted publishing — NO token needed. Requires the PyPI project's
# trusted publisher to be configured once at pypi.org (see setup note at
# the bottom of this file). The `pypi` environment is auto-created by
# GitHub on first run.
environment: pypi
permissions:
id-token: write
contents: write
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v5
with:
python-version: '3.12'
- uses: actions/download-artifact@v4
with:
pattern: wheels-*
merge-multiple: true
path: dist
- name: Publish to PyPI (trusted publishing)
# `uv publish` defaults to dist/*.whl; `--trusted-publishing always`
# uses the OIDC token from the `pypi` environment — no API token.
run: uv publish --trusted-publishing always
- name: Create GitHub Release
uses: softprops/action-gh-release@v2
with:
files: dist/*.whl
generate_release_notes: true
# --- One-time setup (required once, then publishing is fully automated) ---
#
# 1. At pypi.org → Account → Publishing → "Add a new pending publisher":
# • Publisher: GitHub
# • Owner: swadhinbiswas
# • Repository: JustAPI
# • Environment: pypi (must match the job's `environment:`)
# • Workflow name: wheels.yml
# (Trusted publishing auto-creates the `justapi` project on first upload.)
#
# 2. Push a tag: `git tag v2.0.8 && git push origin v2.0.8`
#
# That's it — no MATURIN_PYPI_TOKEN, no secrets. The wheels.yml `publish` job
# then builds the 7-platform matrix, uploads to PyPI via OIDC, and creates the
# GitHub Release with the wheels attached.